Consent-first tracking and the demotion of page and client data

For: Business analysis, marketing ops, and the theme owner who has to action it Scope: Platform behaviour, requirements and risk. No credentials, endpoints or source. See also: CONSENT-RESOLUTION-PATTERN.md · SEGMENTS-GA4-BIDDING.md · MACHINE-ENDPOINT-GRANT-IMPACT.md

1. Executive summary

Google Signals was a subsidy. While it ran, Google supplied — from its own signed-in population, at no cost to your tagging — cross-device identity, demographic and interest dimensions, and a fallback route into remarketing audiences. A thin data layer was survivable because Google was quietly paying the difference.

The subsidy ended, and it did not end alone. Across four dated moves the platform demoted two things an ecommerce theme has treated as load-bearing for a decade: the page view, which stopped being a unit of measurement and became one ordinary event among many, and client-side data, which stopped being a record and became a hint that has to be corroborated somewhere you control.

There is no single deprecation date to point at, and this document does not invent one. There is a demotion, in steps, each with a date — and the operational risk is the opposite of the one teams prepare for. A tag that stops firing gets noticed within a day. A page-view tag that keeps firing, keeps returning numbers, and no longer has identity, consent state, or commercial meaning attached to it does not get noticed at all. It gets reported to a board.

Two forces now sit on the other side of that gap. Consent decides whether a measurement exists, because ad_storage is the sole control on the Google Ads flow and no configuration recovers a denial. And an increasing share of demand arrives through a machine that never renders your page — an AI agent, an answer engine, an MCP client, a peer surface — for which a page view is not a weak signal but a category error. Agents do not browse. They resolve facts and then act.

Recommendation. Treat the page view as telemetry, not as measurement. Move the unit of conversion to a consented, identified, semantically described event; make the theme declare consent before any tag and identity on every step; and publish the facts an agent needs in a form it can read without executing your front end. The work is a data layer contract and a semantic layer, not a replatform.

Risk of no action. Reporting continues, confidently, on a number that no longer means what the person reading it thinks it means — while remarketing reach silently contracts to the consented population and agent-mediated demand resolves against a competitor whose facts were machine-readable.

2. Dated moves, and what each one demoted

Each row is marked with what it is: a verified platform change, or an analytical claim of mine.

Restated as prose, because a table read by a retrieval system arrives as one undifferentiated block and this sequence is the argument.

The page view was never deprecated. It was demoted four times, and the cumulative effect is larger than any single step. GA4 removed the hit type, so a page view stopped being a distinct kind of thing and became an event with a name. February 2024 took Signals out of the reporting identity, so the page view lost the free cross-device identity that had been quietly attached to it. July 2024 switched off Universal Analytics entirely, retiring the platform whose whole model was the pageview hit. June 2026 removed Signals' ad authority and made ad_storage the sole control on the flow into Google Ads, so a page view from a non-consenting visitor now activates nothing at all. And in May 2026 the container itself changed shape, routing measurement through destinations rather than loading a tag per destination.

Anyone still reading "sessions and pageviews" off a dashboard is reading the residue of a model that was dismantled in four moves between 2023 and 2026.

3. Current state: what a typical ecommerce theme still does

Stated as findings, so the gap in section 5 is checkable rather than rhetorical.

F-01 — The theme fires a page view on every route. Including on SPA-style route changes, where it fires again without a document load.

F-02 — Identity is client-side and anonymous. A cookie-scoped client ID, no durable identifier, and a user_id attached at purchase if at all.

F-03 — Consent is a wrapper, not an input. The banner sets state on the visitor's first decision; nothing replays the stored choice on the next load, so a returning consented visitor can run an entire session at the denied default. This is a measured failure mode, not a hypothetical — the consent resolution companion documents a session where the _ga cookie was readable the whole time and the page ran denied regardless.

F-04 — Commercial meaning lives in the template, not the payload. Price, availability, variant, market and shipping eligibility are rendered into HTML. Nothing carries them as data.

F-05 — Sandboxed and iframed contexts are invisible to the container. Web Pixels run sandboxed by design and cannot read the theme's dataLayer; iframed app blocks are separate browsing contexts with their own window, their own consent default and, under storage partitioning, their own cookie jar. Events there are either missing or double-counted, and consent does not cross the boundary.

F-06 — The machine reader gets nothing but rendered HTML. No stable identifiers, no structured offer data, and no route to a fact that does not require executing the front end.

4. Consent-first: the gate moved in front of the tag

The operative change is small to state and large to implement: consent is no longer a compliance wrapper around measurement. It is an input to whether the measurement exists.

Before June 2026 a signed-in consenting user could still reach Google Ads through Signals even where ad_storage was not granted. That parallel route is closed. ad_storage is the only authority, and the failure is silent by construction — no error, no warning, no gap in the GA4 report, just an audience that populates more slowly than it used to.

Three requirements follow, and they are ordered by how often they are got wrong.

CFT-01 — Default before any tag. Consent Mode v2 defaults must be set, denied, with wait_for_update, before any measurement code loads. Anything that fires first fired without a decision. Priority: must.

CFT-02 — Replay on every load, not only on a new decision. The stored choice must be re-applied on each page load and each route change. A banner that only fires on save leaves returning consented visitors running denied. Priority: must. This is the most commonly missed requirement in this document.

CFT-03 — Stamp the resolved state on the event. Carry the resolved consent state as a parameter on each step so the funnel can be segmented into consented and modelled traffic rather than averaging them into a number that describes neither population. Priority: should. This is what turns an unexplained audience shrink into a diagnosable consent-rate problem.

5. Page and client data demotion: from record to hint

Client-side data has not become useless. It has changed evidentiary class, and the distinction is the whole of the analysis.

A client-side event is now a hint: it is fast, rich, and cheap to emit; it is also blockable, spoofable, consent-dependent, partitioned across contexts, and unavailable in exactly the sandboxed and iframed surfaces where a growing share of commerce runs. It is a fine input to a decision and an unsafe basis for a record.

A record is what you can still produce when the browser did not cooperate: a server-side event, a durable identifier, and a ledger row you own. The demotion is not an instruction to stop collecting client-side. It is an instruction to stop concluding from it.

As prose: the page view answers exactly one of the five questions a conversion decision needs, and answers it unreliably. It cannot say who, because a cookie is not a person. It cannot say whether the data may be used, because it carries no consent state. It cannot say what the interaction was worth, because value lives in the template. And it cannot be acted on by a machine, because it describes a rendering rather than a fact.

6. The semantic layer: what an agent needs instead

This is the part that does not follow from analytics history, and it is the part with the shorter runway.

An AI agent, an answer engine, or an MCP client does not view a page. It resolves facts and then acts. It has no session to attribute, no scroll depth, no dwell time, and — critically — no reason to execute your front end at all. Every measurement technique that depends on rendering is invisible to it, and every fact that only exists after rendering is unavailable to it.

What such a reader needs is short, and none of it is a tracking concern:

SEM-01 — A stable identifier per product, variant and offer, the same one in the catalogue, the feed, the page and the API. Not a slug that changes when marketing renames something. Priority: must.

SEM-02 — Machine-readable offer facts — price, currency, availability, market eligibility, shipping and return terms — published as structured data rather than rendered into markup. Priority: must.

SEM-03 — A retrieval surface that does not require the front end. A feed, an API, or an MCP tool. If the only route to your catalogue is a rendered page, an agent's cheapest path is a competitor whose facts it can read directly. Priority: must.

SEM-04 — An authorisation path for a machine acting on someone's behalf — a scoped, expiring, revocable mandate with a spend cap, so an agent can transact under a grant rather than under a shared credential. Priority: should, and it becomes must the first time an agent transacts.

SEM-05 — Consent that survives the machine plane. An agent acting for a person inherits that person's consent state; it does not create a fresh one. Where the mandate cannot express consent, the transaction has no lawful basis regardless of how the checkout was completed. Priority: must.

The division underneath all five: machines authenticate, humans get found. Optimising the same surface for both produces a page that neither reads well.

7. AEO and SEO are different readers — and the page view still serves one of them

Demoted is not deleted. The page view lost four jobs it was never good at; it keeps the one job it has always been good at, and separating those cleanly is what stops this analysis from becoming an argument to rip out tracking.

SEO optimises a page for a reader who will render it. A person arrives, the layout loads, they scan, scroll, hesitate, and either find the thing or leave. Every one of those behaviours is a rendering event, which means a page view — and its companions, scroll depth, time on page, rage clicks, exit rate — is a direct measurement of the experience, not a proxy for anything. For that job the page view is not merely still valid; there is nothing better.

AEO optimises facts for a reader that will not render anything. An answer engine or a shopping agent wants price, availability, terms, identifiers and eligibility, and it wants them without executing a front end. Nothing about the experience is relevant to it. There is no layout to get wrong, no fold to be above, and no dwell time to lengthen. A page view here does not measure a weak version of engagement; it measures nothing, because nothing was viewed.

The failure teams make is not choosing the wrong one. It is using one number for both readers — reporting page views as though they described total demand, when they describe only the rendering half of it, and then optimising the site for the half that is easiest to count.

As prose, because the split is the point. For a human reader the page view is a utility signal: it tells you whether the interface worked, and it is the correct instrument for that question. For a machine reader the page view is a category error: it reports on a rendering that never occurred, and treating its absence as weak demand will systematically understate exactly the channel that is growing.

The practical rule that follows: keep the page view, demote its authority, and stop letting it answer questions about demand. Use it for what it measures — did this interface work for the person in front of it — and move identity, consent, value and machine legibility onto the instruments built for them. A theme that does both is optimised for two readers on purpose. A theme that does neither is optimised for a dashboard.

8. Impact on the theme

The sequencing point a BA should press: the two lowest-effort rows are also the two highest-risk ones. Consent replay and demoting the page view are configuration and discipline, not engineering. They should not be scheduled behind the semantic layer, and they routinely are — because the semantic layer is the interesting work and consent replay is not.

9. Impact on agentic conversion strategy

Four strategic consequences, stated as they affect the commercial model rather than the tag.

The funnel stops being a sequence. An agent does not traverse awareness to consideration to purchase. It resolves a constraint set and acts, sometimes in one call. Optimising step-to-step conversion rates describes a journey a growing share of your demand does not take.

Attribution loses its last-click anchor. There is no click. There may be no referrer, no landing page, and no session. Conversions arrive attached to a mandate rather than to a campaign, and a measurement model that cannot represent that will record your agent revenue as direct traffic.

Audience shrink is a floor, not a dip. Reach is now bounded by the consented population, and no tagging change lifts that bound. The honest levers are three: raise the consent rate, raise the match rate for those who consented, and raise the value extracted per consented identity. The first is design and legal, the second is engineering, the third is commercial.

Machine legibility becomes a distribution channel. If an agent cannot resolve your price, availability and terms without rendering your theme, you are not in its consideration set — and unlike a ranking, there is no partial credit. This is the one place where the work has upside rather than merely avoided loss.

10. Prioritised backlog

1. Consent default before any tag (CFT-01). Low effort, must. Verify in the network panel: the consent call precedes every measurement request.
2. Replay stored consent on every load (CFT-02). Low effort, must. Verify with gcs on the first hit of a returning consented session — G111 is a pass, G110 is the defect.
3. Durable user_id on every funnel step. Medium, must. Verify in DebugView across a full session, not only at purchase.
4. Stamp consent state on events (CFT-03). Low, should.
5. Emit commercial value as parameters, not template markup. Medium, should.
6. Stable identifiers and structured offer facts (SEM-01, SEM-02). Medium, must, and the long pole.
7. A non-rendering retrieval surface (SEM-03). Medium–high, must, and the item most often deferred past its usefulness.
8. Mandate-based authorisation for agents (SEM-04, SEM-05). Higher, and the trigger is commercial rather than technical — schedule it before the first agent transaction, not after.

Items 1 and 2 are achievable in a single afternoon and remove the largest silent loss in the list. Nothing else should be scheduled ahead of them.

11. Risk register

R-02 is the one that reads as a business problem rather than a technical one, which is why it is usually escalated last and diagnosed slowest.

12. What this analysis does not establish

No page-view deprecation date is claimed, because none was found. If a specific dated deprecation of page-view container tagging exists, this document is wrong in a way that is easy to correct, and the correction should be sent rather than assumed.

Sections 6 to 11 are analysis, not measurement. The requirement set, the effort ratings and the risk likelihoods are judgements about this shape of stack. They have not been validated against a specific property, and the effort column in particular will move with how much of the theme is already componentised.

No amount of tagging recovers a denied ad_storage. Stated again here because it is the claim most often contradicted by a vendor. There is no configuration, no server-side container, and no identifier scheme that places a non-consenting visitor into a remarketing audience. Anything offered as one is describing a consent violation.

Agentic volume is not forecast here. The strategic argument in section 9 holds whether agent-mediated demand is two percent or twenty, because the cost of being machine-legible is roughly the same either way. Anyone who gives you a percentage for your category is guessing.

Sources

• Loves Data — Google signals will be removed from the reporting identity
• Louder — Google signals removed in GA4
• Analytico — Google Signals loses its ad authority: the June 2026 Consent Mode takeover
• Dataslayer — GA4 + Google Ads data controls: what changes June 15, 2026
• Tag Manager Help — Updates to Google tag and Google Tag Manager
• Louder — How to remove Universal Analytics